4,948 results · Feed
-
MediumALAS2023-2023-157 2 CVEs
Moderate: yasm security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2021-33459: An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in nasm_parser_directive() in modules/parsers/nasm/nasm-parse.c. CVE…
first Mar 30, 2023 -
Medium max 6.2ALAS2023-2023-156 3 CVEs
Moderate: containerd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25173: containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not se…
first Mar 30, 2023 -
High max 5.5ALAS2023-2023-153 1 CVE
Important: tar security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the f…
first Mar 30, 2023 -
High max 7.8ALAS2023-2023-147 1 CVE
Important: emacs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-28617: org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or direct…
first Mar 30, 2023 -
Medium max 5.5ALAS2023-2023-154 4 CVEs
Moderate: redis6 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-25155: Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SRANDMEMBER`, `ZRANDMEMBER`, and `HRANDFIELD` comm…
first Mar 30, 2023 -
Medium max 6.3ALAS2023-2023-152 1 CVE
Moderate: wireshark security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1161: ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture…
first Mar 30, 2023 -
Medium max 8.4ALAS2023-2023-151 4 CVEs
Moderate: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402. CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9…
first Mar 30, 2023 -
Medium max 5.5ALAS2023-2023-150 1 CVE
Moderate: ImageMagick security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1289: A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. This flaw allows a remote…
first Mar 30, 2023 -
Medium max 2.6ALAS2023-2023-149 1 CVE
Moderate: python-werkzeug security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-23934: Werkzeug is a comprehensive WSGI web application library. Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulne…
first Mar 30, 2023 -
High max 7.5ALAS2023-2023-142 1 CVE
Important: golang security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41723: http2/hpack: avoid quadratic complexity in hpack decoding
first Mar 20, 2023 -
High max 7.7ALAS2023-2023-139 3 CVEs
Important: php8.1 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0662: In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumptio…
first Mar 20, 2023 -
Low max 7.3ALAS2023-2023-137 1 CVE
Low: vim security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-1127: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
first Mar 20, 2023 -
High max 7.8ALAS2023-2023-134 2 CVEs
Important: emacs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27986: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quo…
first Mar 20, 2023 -
High max 9.8ALAS2023-2023-136 2 CVEs
Important: httpd security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27522: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Spe…
first Mar 20, 2023 -
High max 7.5ALAS2023-2023-140 1 CVE
Important: tomcat9 security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-42252: If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via set…
first Mar 20, 2023 -
HighALAS2023-2023-141 1 CVE
Important: device-mapper-multipath security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-41974: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Lo…
first Mar 20, 2023 -
Low max 5.5ALAS2023-2023-145 1 CVE
Low: gcc security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-27943: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
first Mar 20, 2023 -
LowALAS2023-2023-144 1 CVE
Low: autotrace security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-32323: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.
first Mar 20, 2023 -
Low max 5.3ALAS2023-2023-143 1 CVE
Low: docker security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-36109: A flaw was found in Moby. This flaw allows an attacker to bypass primary group restrictions due to a flaw in the supplementary group access setup.
first Mar 20, 2023 -
High max 9.8ALAS2023-2023-146 11 CVEs
Important: python-pillow security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-45199: Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. CVE-2022-45198: Pillow before 9.2.0 performs Improper Handling of Highly Compressed G…
first Mar 20, 2023 -
LowALAS2-2023-2003 1 CVE
Low: ghostscript security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-25059: Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839.
first Mar 17, 2023 -
Medium max 7.4ALAS2-2023-2002 2 CVEs
Moderate: xdg-utils security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4055: When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that…
first Mar 17, 2023 -
High max 7.5ALAS2-2023-2001 4 CVEs
Important: bind security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-38178: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradu…
first Mar 17, 2023 -
Medium max 5.5ALAS2-2023-2000 1 CVE
Moderate: gstreamer1-plugins-base security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3522: A flaw was found in gstreamer-plugins-base where an out-of-bounds read when handling certain ID3v2 tags is possible. The highest threat from this vulnerabi…
first Mar 17, 2023 -
MediumALAS2-2023-1999 1 CVE
Moderate: openjpeg security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3575: A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled…
first Mar 17, 2023 -
MediumALAS2-2023-1998 1 CVE
Moderate: libsndfile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-4156: An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (via tricking a u…
first Mar 17, 2023 -
MediumALAS2-2023-1997 1 CVE
Moderate: audiofile security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24599: In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensit…
first Mar 17, 2023 -
Medium max 7.8ALAS2-2023-1996 2 CVEs
Moderate: libxml2 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-40304: An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent l…
first Mar 17, 2023 -
High max 8.8ALAS2-2023-1995 1 CVE
Important: sssd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-4254: A vulnerability was found in SSSD, in the libsss_certmap functionality. PKINIT enables a client to authenticate to the KDC using an X.509 certificate and t…
first Mar 17, 2023 -
High max 5.5ALAS2-2023-1994 1 CVE
Important: tar security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow…
first Mar 17, 2023 -
High max 8.8ALAS2-2023-1992 1 CVE
Important: nss security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0767: firefox-esr , thunderbird and nss only are affected by this package.
first Mar 17, 2023 -
Low max 7.3ALAS2-2023-1991 1 CVE
Low: vim security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-1127: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.
first Mar 17, 2023 -
Medium max 7.5ALAS2-2023-1990 1 CVE
Moderate: python3 security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24329: An issue in the urllib.parse component of Python before v3.11 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank ch…
first Mar 17, 2023 -
High max 9.8ALAS2-2023-1989 2 CVEs
Important: httpd security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-27522: HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Specia…
first Mar 17, 2023 -
High max 8.8ALAS2-2023-1988 5 CVEs
Important: thunderbird security update (Amazon Linux 2)
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-28176: Mozilla Fuzzing Team reported memory safety bugs present in Firefox 110 and ESR 102.8. Some of these bugs showed evidence of memory corruption, and we pre…
first Mar 17, 2023 -
High max 7.8ALAS2023-2023-131 1 CVE
Important: xorg-x11-server security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-0494: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo(…
first Mar 11, 2023 -
Medium max 5.4ALAS2023-2023-130 1 CVE
Moderate: python-twisted security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-39348: Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twist…
first Mar 11, 2023 -
High max 7.5ALAS2023-2023-129 1 CVE
Important: aws-nitro-enclaves-cli security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-31394: Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to…
first Mar 11, 2023 -
High max 5.3ALAS2023-2023-128 1 CVE
Important: nodejs security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-25881: This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server…
first Mar 11, 2023 -
High max 7.2ALAS2023-2023-133 1 CVE
Important: sudo security update (Amazon Linux 2023)
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27320: Sudo before 1.9.13p2 has a double free in the per-command chroot feature.
first Mar 11, 2023